FedRAMP 20x
KSI validation, VDR and VER, Classes A to C
Explore 20x →- Home
- Frameworks
Eight federal frameworks. One evidence base.
Cloud providers, defense contractors, agencies and state governments answer to different rules that share the same NIST foundation. NISTcompliance.ai covers eight of them from one evidence base. Pick yours.
Runs inside Quzara Cybertorch: FedRAMP Certified, Rev5 Class D (High)SOC 2 Type 2
Frameworks
Choose your framework
FedRAMP Rev5
Classes B to D under the 2026 rules
Explore Rev5 →GovRAMP
State and local cloud verification
Explore GovRAMP →CMMC and NIST 800-171
Level 1 and Level 2 self-assessment, SPRS, DFARS 7012
Explore CMMC →DoW Impact Levels
IL2 to IL6 and DISA Provisional Authorization
Explore Impact Levels →FISMA and RMF
System packages, ongoing authorization, reporting
Explore FISMA →NIST CSF 2.0
Six functions, profiles and evidence
Explore CSF 2.0 →NIST AI RMF
AI risk, the GenAI profile and OMB AI policy
Explore AI RMF →Compare
Who each framework applies to
Swipe to see every column
| Framework | Applies to | Authority | Who assesses | Key date |
|---|---|---|---|---|
| FedRAMP 20x | Most new cloud offerings, recommended for those built on FedRAMP Certified infrastructure; Classes A to C today | FedRAMP Consolidated Rules for 2026 | FedRAMP Recognized assessor, yearly for Classes B and C | VDR and VER mandatory Dec 7, 2026 |
| FedRAMP Rev5 | Agency-sponsored cloud, own infrastructure or Class D | FedRAMP Consolidated Rules for 2026 | FedRAMP Recognized assessor, yearly | New applications close Jun 11, 2027 |
| GovRAMP | Cloud vendors to state, local, tribal and territorial governments | GovRAMP Security Assessment Framework v4.2 | 3PAO; Core by the GovRAMP office | SAF v4.2 adopted Apr 21, 2026 |
| CMMC | Department of War (DoD) contractors handling FCI or CUI | 32 CFR Part 170; DFARS 252.204-7021 | Contractor, C3PAO or DIBCAC | Phase 2 suspended Jul 13, 2026; self-assessments plus select Government-led assessments |
| DoW Impact Levels | Cloud offerings serving Department of War (DoD) missions | DISA Cloud Service Provider SRG | FedRAMP-recognized assessor with DISA review | IL5 scoped to National Security Systems in CSP SRG V1R3, Jul 2025 |
| FISMA and RMF | Federal agencies and their systems | FISMA 2014; OMB A-130; NIST SP 800-37 | Agency assessors; IG every year | CIO FISMA metrics v1.1, Sep 1, 2026 |
| NIST CSF 2.0 | Any organization managing cyber risk | NIST CSWP 29 | Set by the organization | SP 1347 references guide, Aug 25, 2026 |
| NIST AI RMF | Organizations building, deploying or buying AI | NIST AI 100-1; OMB M-25-21 for agencies | Set by the organization | 1.0 under revision |
Details and primary sources are on each framework's page.
Book a demo
Not sure which applies to you?
We will map your customers and contracts to the frameworks you actually need.